Skip to content

RFE: systemd-homed: support v2 fscrypt policies that do not require keyring inheritance for access #18280

@justinfenn

Description

@justinfenn

systemd version the issue has been seen with

systemd 247 (247.2-1-arch)

Used distribution

Arch Linux

Linux kernel version used (uname -a)

5.10.7-arch1-1

CPU architecture issue was seen on

x86_64

Expected behaviour you didn't see

Files in a homed-controlled (fscrypt) directory should be readable through container bind mounts.

Unexpected behaviour you saw

Attempting to read files results in a Required key not available error.

Steps to reproduce the problem

Using podman with rootless containers:

$ podman pull docker.io/archlinux
$ podman run --rm -it -v ${HOME}:/vol archlinux
[root@02ec678d0913 /]# cat /vol/file.txt
cat: /vol/file.txt: Required key not available

The file becomes readable within a container if it is read from outside first:

$ cat file.txt
hello
$ podman run --rm -it -v ${HOME}:/vol archlinux
[root@a89467eafa05 /]# cat /vol/file.txt
hello

Additional info

Looks similar to google/fscrypt#128 which was mentioned in this comment thread in the original systemd-homed PR.

Metadata

Metadata

Assignees

No one assigned

    Labels

    RFE 🎁Request for Enhancement, i.e. a feature requesthomedhomed, homectl, pam_homed

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions